Experts are warring * 
about viruses in 
infected attachments 

by David L.Wilson 

Mercury New s Wellington Bnre.m 

WASHINGTON — The holiday season Is often a 
time when computer useis pass around amusing 
electronic animations via e-mail. Although most of 
these attachments are harmless, some may hide 
* destructive computer virus- 
es. 

Indeed, anti-virus watch- 
dogs identified a new \ims 
: this week that masquerades 
as an innocuous bunch of 
digital photos but actually 
plants a time bomb that will 
erase the computers haid 
drive on Jan. 1, 2000. 

Because that's the same 
date that the Y2K bug is ex- 
pected to cause many comput- 
er systems to crash, the virus 
might fool users into believing 
they have a Y2K problem. 

Virus fighters expect more 
viruses linked to Y2K to 
emerge as Jan. 1 approaches, 
and they are once again beg- 
ging computer users to avoid 
opening e-mailed attach- 
ments. 

\ "We're telling people to be 
very wary of electronic Christ- 
mas cards/' said Sal Viveros, a 
virus expert with Network As- 
sociates Inc., based m Santa Clara. 

The Mypics worm, as this latest threat is called, 
arrives attached to what appears to be e-mail from 
a friend or associate that says, "Here's some pic- 
tures for you!" 

Opening the attached file, Pics4You.exe, will in- 
fect your computer with the virus, which will at- 
See VIRUSES, Page 3C 
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Many computer viruses travel as innocent-looking files attached to 
electronic mail. With the holiday season upon us, people often e-mail - 
electronic greetings and photographs to friends and family members;; ^ 
but not every file that comes with an e-mail issafejhis year'poses 
special hazards, according to anti-virus experts', because many virus 
writers may use theY2K bug to hide their mischief. This week, anti- 
virus companies detected a new virus, named My pics/that could 
erase a computer's hard drive on Jan. 1. r; - - — 



tWORf^ ARRIVES' 
^ You get an e-mail with an " 

attachmentnamedPics4You.exe 
saying, "Here's some pictures for 
you!" 



WORM REPRODUCES 
If you open the attachment the worm 
will send itself to 50 people in your 
Microsoft Outlook address book, it 
aiso changes the home page of yobr 
Microsoft Internet Explorer browser 
to a pornographic Site. 
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tempt to mail itself to 50 people it 
finds in your Microsoft Outlook e- 
mail address book. It will also 
change the home page of your Mi- 
crosoft Internet Explorer Web 
browser to a pornogi aphic site. 

The real damage occurs Jan. 1, 
when the viius will change the com- 
puter's most basic software and at- 
tempt to erase the hard chive. 

The inci easing frequency of alerts 
relating to thmgs like electronic \\- 
ruses is prompting renew cd calls for 
safe computing, but few experts ex- 
pect users to change their habits. 

"It would be gieat if even body 
followed the rule: Never open c-mail 
attachments if you can help it," said 
Carey Nachenberg, chief reseai cher 
at Symantec's anti-viial research 
center. "But I don't tluiik they will" 

In general, just looking at an infec- 
ted e-mail can't hurt; users ha\e to 
do something el be to activate the vi- 
rus and infect their system. Topical- 
ly, a virus comes as an attachment to 
e-mail, such as a document that can 
be read only with a word processor 
like Microsoft Word. 

Clicking on the attachment to 
read the document can infect the us- 
er's madune \\ i Hi any \ints that was 
lurking on the sender's machine. A 
virus is dangerous because it can al- 
ter or destroy data 

Until recently, experts advised us- 
ers to simply avoid opening attach- 
ments sent by people they didn't 
know. Unfortunately, the most trou- 
blesome viruses today spread by 
fooling people into believing the 
document u as sent by a friend. 

For instance, Mypics attempts to 
mail copies of itself to anyone in the 
user's e-mail address book. Anyone 
receiving such a missive from, say, 
their brother, might open that at- 
tachment without thinking about it 

Most software vendors are awaie 
of the problem and talce steps to get 
around it For instance, Blue Moun- 
tain Arts, a purveyor of electronic 
greeting cards, doesn't send the card 
via e-mail, just a Web address, w hich 
can be accessed though any brow s- 
er. 

Jared P. Schutz, the company's ex- 
ecutive director, said that's the only 
way to be safe. 'T would highly rec- 
ommend that people avoid opening 
attached files, even from people that 
they know " he said. 
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Source: Symantec Corp 

That's the standard ad\ice, but no- 
body expects aitadiments to disap- 
pear tomorrow, despite the warn- 
ings. 

"I can't tell you whether we've still 
got a lot of people who just haven t 
gotten the message — newbies — or 
whether it's people who should 
know better but do it anyway, ** said 
Sandra Sparks, director of the Ener- 
gy Department's Computer Incident 
Advisory Capability, wluch works to 
ensure the security of government 
computer systems. "Maybe it's the 
same kind of thing that happens with 
people w ho don't \\ ear a seat belt.*' 

Although many coiporations scan 
all incoming e-mail and destroy any 
known virus before it's delivered in- 
to an employee's mailbox, very few 
Internet service providers offer such 
a feature, laigeiy because exanuning 
every single data packet that flows 
into the pipes can slow service. 

So for now, anti-virus protection 
is largely the responsibility of indi- 
viduals. 

To protect against all viruses, ex- 
perts say vims piotection software 
should be updated weekly. 



WORM WAITS 

On Jan. 1, 2000, the worm will overwrite 
key system data. The user will see an 
apparent Y2K-re!ated error when 
starting up the computer. The worm will 
then destroy al! data on the hard drive. 
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Atfaduncnts generally should be 
avoided. If you receive an attach- 
ment that you want, contact the 
sender and ask if it was deliberately 
sent If possible, ask that the infor- 
mation in the attachment be copied 
and pasted Into a plain e-mail file 
and resent, or posted on a Web page. 

If that's not possible and you must 
open the attachment, make sure it's 
scanned first with an updated anti-vi- 
ral program. 

Even with such precautions, it's 
still possible for a new, fast-moving 
virus to get through your defenses. 
The only real protection users have 
is to regularly make copies of the da- 
ta on their hard drive 

"Back up your critical stuff at 
least once a week," said Sparks. "I 
know that's annoying, and I know it 
takes time. But compare that 
amount of time vs. the amount of 
time you'd spend trying to lebuild 
your system, or your company, and 
that's a very small investment" 



Contact David Wilson at (202) 

383-6020 or at 

dtcilsori @sjmercv ry. com. 



Avoid opening attachments to e-maii if possible. If you want the attachment, 
call the sender and verify its contents before opening it. Update virus 
protection software weekly and use it to scan attachments. Back up critical 
data regularly. 
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